What TIBER-IE requires of an Irish firm and who decides
The Central Bank of Ireland runs TIBER-IE as the designated authority for TIBER and DORA threat-led penetration testing (TLPT) in Ireland. A TIBER test is a controlled, bespoke, intelligence-led red team test of critical production systems, and it is not pass or fail: it shows where the firm is strong and where it is weak so the firm can raise its cyber maturity. If your firm has received a letter from the Central Bank or a contract requires you to join a test, the first question is whether the test is mandated under DORA or voluntary, because that answer decides the formal obligations that follow.
The Central Bank's national programme now covers both routes. Where the Central Bank or another competent authority requires a DORA TLPT, the test must meet the formal requirements that authority sets, and the Central Bank states that the TIBER-EU framework has been updated to meet all DORA TLPT requirements. Where a firm joins voluntarily, the test follows the same framework but the regulatory consequences differ. Confirm in writing with the Central Bank which route applies to your firm, which authority will accept the test result, and whether a mandated test will be run under the same process as a voluntary one.
Whichever route applies, ask the Central Bank for the supplemental TIBER-IE material it provides at the start of each assessment and read it before scoping begins. Check which supplemental documents apply to your firm's size, activities and existing ICT maturity, and identify the named contacts for your test. Also confirm which Central Bank guidance on service provider procurement, the control team and purple teaming your procurement and governance plans must follow, since the Central Bank points firms to these ECB documents.
Mandated DORA TLPT versus voluntary TIBER-IE tests
A firm that the Central Bank of Ireland designates for threat-led penetration testing under DORA must test, whatever its own view of its maturity. The Central Bank is the designated authority for TIBER and DORA TLPT in Ireland, so the designation decision and the formal requirements for the test come from it. The core requirements of the TIBER-EU framework match those of DORA TLPT, which means the same process steps, deliverables and quality standards apply to a mandated test.
- Trigger: The designation is made by the Central Bank under DORA. Firms should not assume they are in or out of scope without written confirmation.
- Expectation: The test must follow the TIBER-EU process on critical production systems, with a controlled scope agreed at the start.
- Supporting material: The Central Bank supplies supplemental TIBER-IE material at the start of each assessment, which should be read before scoping begins.
- Guidance to use: The Central Bank points firms to the ECB guidance on service provider procurement, the control team and purple teaming.
- Outcome: The test is not pass or fail. It shows strengths and weaknesses that the firm must address through its remediation plan.
Confirm your designation status and any formal requirements directly with the Central Bank of Ireland before procuring providers or fixing a timeline.
A firm that is not designated can ask to take part in a voluntary TIBER-IE test. The Central Bank's programme covers voluntary TLPT assessments alongside mandated tests, so the entry route is an application to the authority rather than a DORA obligation. The test follows the same TIBER-EU phases and quality standards as a mandated test, but the consequences differ, and the firm should be clear about them from the start.
- Trigger: The firm's own decision to engage the Central Bank, usually after reviewing its cyber maturity and the value of an intelligence-led test.
- Expectation: The Central Bank expects the same controlled, bespoke, intelligence-led approach to critical production systems.
- Qualifying the result: A voluntary test that meets the core requirements is not automatically DORA TLPT. Whether it counts depends on the competent authority's formal requirements being met too.
- Cost and effort: The firm pays for its own providers and internal time. Ask any provider for a written, itemized quote that separates threat intelligence, red team testing and reporting.
- Repeat cycles: Confirm with the Central Bank how often a voluntary firm may test, since the framework treats intervals of about three years as the norm.
Ask the Central Bank in writing whether a voluntary test would be accepted as DORA TLPT for your firm before you commit budget.
A firm authorized in another EU state that operates in Ireland may fall under a different TIBER-EU implementation and a different competent authority. Adoption is voluntary for each authority, and the framework allows mutual recognition of tests among authorities that have adopted it, which can spare multinational firms duplicate tests. Recognition depends on the test meeting the mandatory requirements, so the home and host authorities both matter.
- Identify the home authority: Establish which authority supervises the firm's entity or group and whether it has its own TIBER-EU implementation.
- Ask about the Irish position: Confirm with the Central Bank whether a test run under the home authority covers operations in Ireland.
- Check mutual recognition: Recognition applies only where the test meets the mandatory requirements of the framework, so ask for the test's compliance evidence.
- Avoid parallel tests: Agree one scope and one control team across jurisdictions where the authorities accept it, to reduce duplicate effort.
- Document the decision: Record the designation or recognition position in writing for auditors and supervisors.
Confirm your position with both your home authority and the Central Bank of Ireland before agreeing a scope that covers Irish operations.
What supplementary TIBER-IE material firms receive at the start
The Central Bank gives each tested firm supplemental TIBER-IE material when an assessment starts, and it points firms to the ECB's 2025 guidance for the parts of the test that depend on outside providers and internal roles. Read these documents before scoping, because they set the procedure the firm will be held to.
Supplemental TIBER-IE material
The Central Bank supplies this material to the institution at the start of each assessment. It sits on top of the TIBER-EU framework and reflects how the Central Bank runs tests in Ireland. Ask the Central Bank's TIBER team at kickoff which version applies to your test, and check that your project plan, governance and reporting lines match the expectations it sets out.
Service provider procurement guidance
The ECB's guidance on procuring the threat intelligence provider and red team testers is the first document the Central Bank points firms to. Use it to set provider selection criteria, conflict of interest checks and contract terms before tendering. Procurement is where many delays start, so agree the provider shortlist and contract timing with the Central Bank early.
Control team guidance
The Central Bank directs firms to the ECB's guidance on the control team, which the 2025 framework renamed from the White Team. The control team supervises the red team under the test manager and keeps the test controlled. Name its members, confirm who holds the authority to stop the test, and document how it protects live production systems.
Purple teaming guidance
The 2025 framework made purple teaming mandatory, and the Central Bank refers firms to the ECB guidance on it. It describes how red and blue team staff review attack techniques together after the active test. Plan time and staff for these sessions in the closure phase, and confirm with the Central Bank how the sessions are recorded.
Other 2025 ECB guidance documents
The ECB also published guidance on initiation documents, the scope specification document, the targeted threat intelligence report, the red team test plan, the red team test report, the blue team test report, the remediation plan, the test summary report and the attestation. Map each one to a phase and an owner in your project plan. Ask the Central Bank which of these it expects to receive and in what format.
How a TIBER-IE test moves from notification to attestation
The Central Bank of Ireland runs each TIBER-IE test through the three mandatory TIBER-EU phases, and each phase closes with a defined output that the next one depends on. The sequence ends with an attestation once the entity has its reports, a test summary and a remediation plan in place.
Receive written notification from the Central Bank
The Central Bank of Ireland, as designated authority for TIBER and DORA TLPT, notifies the entity in writing that a test will run. This starts the preparation phase, which lasts up to six months from that notification. The entity's board and senior management should confirm who will act as its control team lead and single point of contact before the next step begins. The step is complete when the notification is on file and the entity has named its internal owners.
Initiate the test and set up the control team
The entity and the authority hold the initiation step, where the test is set up and the roles are confirmed. The entity forms its control team, which manages the test on its side and keeps the risk controls in place so that live production systems are protected. The Central Bank supplies its supplemental TIBER-IE material at the start of the assessment. The step is complete when the control team is in place and the initiation documentation is agreed.
Scope critical functions and flags
The entity identifies its critical or important functions and the production systems that support them, then records these in the scope specification document. Flags are the specific targets the red team will try to reach, and the Central Bank reviews them with the entity. Scope is settled with the authority before any provider is engaged. The step is complete when the scope specification document is approved and the flags are fixed.
Procure the threat intelligence provider and red team testers
The entity procures external providers under the ECB's service provider procurement guidance, selecting a threat intelligence provider and red team testers who meet the framework's requirements. Contracts should reflect the test's scope, confidentiality and risk controls. This is the last activity in the preparation phase. The step is complete when both providers are contracted and the entity can show the procurement record to the authority.
Deliver targeted threat intelligence and the red team test plan
The testing phase opens with the threat intelligence provider producing the targeted threat intelligence report, which selects the scenarios most relevant to the entity. The red team then writes the red team test plan based on those scenarios and the agreed flags. The control team and test manager review both documents before testing starts. The step is complete when the report and plan are approved in writing.
Run at least 12 weeks of active red team testing
The red team carries out active testing against the flags for at least 12 weeks, under the supervision of the control team and the test manager at the authority. The blue team at the entity works to detect and respond without being told in advance what is happening. The control team keeps the test within agreed boundaries and can stop activity that threatens live services. The step is complete when active testing has ended and the red team has logged its activity.
Issue reports, replay and purple teaming in closure
Within 10 weeks of the end of active testing, the red team issues its test report and the blue team issues its own report. The parties then hold a replay of the key attack paths, followed by purple teaming, where red and blue work together on detection and response gaps. The closure phase also includes 360 degree feedback. Within 8 weeks of the authority's assessment, the entity delivers the test summary report and remediation plan, and the process ends with the attestation. The step is complete when the attestation is issued and the remediation plan is in progress.
What the firm owns, what a partner prepares and what the Central Bank decides
A TIBER-IE test divides work across five parties, and the division matters for independence. The firm keeps ownership of its controls, its control team and its remediation, while support providers prepare evidence and the Central Bank of Ireland oversees the process and the attestation.
The firm owns its controls
The firm remains accountable for its ICT controls, the critical production systems in scope and the decisions about what the test may touch. A consultant can explain a control, but cannot accept risk on the firm's behalf. Before a test, confirm in writing which functions and flags the firm has approved, and who signs the scope specification document.
The control team stays internal
The control team is the firm's own group that knows the test is running and manages it on the firm's side. Its members should be staff who will not be replaced mid-test, and it should be able to stop the red team if the test threatens live services. Outside advisers may support the team, but they should not replace it. Check the ECB guidance on the control team before naming members.
A partner prepares systems and evidence
An implementation partner can prepare logging, monitoring and evidence collection, and help assemble procurement documents for the threat intelligence and red team providers. This work prepares the firm for the test but does not replace any step in it. Agree in a fixed written scope which deliverables the partner prepares and which the firm signs.
Providers run their own parts
The threat intelligence provider builds the targeted threat intelligence report, and the red team testers plan and run the attack under supervision. Both are procured by the firm under the ECB's service provider procurement guidance, and their independence from the firm's own service providers should be documented. Ask each provider for evidence of its qualifications and for its own reporting lines.
The Central Bank oversees the process
The Central Bank of Ireland is the designated authority for TIBER and DORA TLPT in Ireland. It supervises the TIBER Cyber Team and test manager, reviews test documents and supplies the TIBER-IE supplemental material at the start of each assessment. Its role is oversight of the process, so the firm should expect it to direct questions about scope and method to the authority.
Attestation comes from the process
The attestation closes the test and is issued through the framework's closure steps, after the authority's assessment. No consultant, including the firm's implementation partner, can issue it or substitute a private report for it. A TIBER-IE test also gives no pass or fail result, so the firm should not market a consultant's summary as an official outcome. Ask the authority which document it will accept as the attestation.
Questions Irish firms ask about TIBER-IE
Is a TIBER-IE test a pass or fail exercise?
No. A TIBER-IE test is not pass or fail. The Central Bank of Ireland describes it as a controlled, bespoke, intelligence-led red team test of critical production systems, and the purpose is to show where the firm is strong and where it is weak so it can raise its cyber maturity. The output is a set of findings, a blue team view of how detection and response performed, and a remediation plan that the firm owns. Ask the Central Bank how it will use the test summary report in supervisory dialogue, because that use shapes how the firm should prepare its internal reporting.
How does a TIBER-IE test differ from a DORA TLPT mandate?
TIBER-IE is the Irish programme for running TIBER-EU. DORA threat-led penetration testing (TLPT) is the legal obligation that can require a firm to test under that method. The ECB states that the core requirements of DORA TLPT and TIBER-EU are identical, so a firm that completes a TIBER-IE test can meet DORA TLPT if it also satisfies the formal requirements set by its competent authority. The Central Bank is the designated authority for both, so a firm should confirm with it whether a given test is voluntary or mandated, because the designation determines the legal consequences.
Does a voluntary TIBER-IE test count toward DORA TLPT?
It can, but only if the test meets the requirements that apply to DORA TLPT and the competent authority accepts it on that basis. The Central Bank's programme covers both mandated and voluntary assessments, and the ECB links TIBER-EU compliance to DORA through the shared core requirements. A voluntary test does not automatically satisfy an obligation. Before scoping, ask the Central Bank in writing whether the planned test would be recognized as DORA TLPT, which documents it expects, and how the result would be reflected in supervisory records.
What must the firm provide, and how much internal effort does it need?
The firm must provide a named control team, a blue team, access to critical production systems under agreed rules, and the records needed to scope flags and critical functions. The control team tracks the test, manages risk and keeps the test manager informed, so it needs people with authority over the systems in scope. Effort depends on how many functions are in scope, how mature the firm's monitoring and incident handling are, and how many internal teams must be involved. Ask the Central Bank and your provider for a written list of roles, expected time commitments and the documents you must prepare before the initiation phase.
Can an external consultant run the TIBER-IE test for the firm?
A consultant cannot run the test on the firm's behalf or act as the authority. The TIBER Cyber Team and test manager belong to the authority, and the control team and blue team belong to the tested entity. External providers supply the threat intelligence and red team testing, and the procurement guidance from the ECB sets out how those providers are chosen. A firm can also bring in an implementation partner to prepare systems, logging, documentation and evidence, but the firm keeps ownership of its controls and decisions. Any party that issues a report or attestation must be independent, so confirm each role in writing before contracts are signed.
How often do TIBER-IE tests recur?
The TIBER-EU framework treats an interval of three years between tests as the norm, because tests consume significant resources and costs. Firms should plan for a cycle rather than a single exercise, and the Central Bank will set the timing for mandated tests. Between tests, firms can use the remediation plan to close gaps and improve detection and response. Ask the Central Bank whether a specific firm falls on a fixed cycle and whether any interim activity is expected, because the answer affects budgeting and staffing.
What drives the cost of a TIBER-IE test, and how do we confirm current requirements?
Cost is driven by the size and complexity of the scope, the number of critical functions and flags, the threat intelligence and red team providers procured, the time the red team needs in active testing, and the internal effort for the control team and blue team. Costs are both one-time for the test itself and recurring through the programme cycle and remediation. Ask for a written quote that separates provider fees, internal staffing and any remediation work. To confirm current requirements, check the Central Bank's TIBER-IE page, the 2025 TIBER-EU framework and the ECB guidance on procurement, the control team and purple teaming, and confirm the scope with your authority before committing budget.
What to confirm with the Central Bank before scoping
Before a scope is signed, confirm three things directly with the Central Bank of Ireland: whether your firm is in the test as a voluntary TIBER-IE participant or as an entity whose DORA threat-led penetration testing is mandated, the formal DORA requirements that attach to that status, and which supplementary TIBER-IE material applies to your test. The Central Bank is the designated authority for TIBER and DORA TLPT in Ireland, so its position on designation governs the rest of the engagement. Ask for that position in writing and file it with the scope documents, because the timeline, the testers you may procure and the attestation route all depend on it. Start with the Central Bank's TIBER-IE page, which is the primary source for the Irish programme.
Next, confirm which DORA requirements the Central Bank treats as binding on your test. The Central Bank states that TIBER-EU has been updated to meet all requirements of DORA TLPT, but it still expects firms to check the formal requirements its supervisors set for each entity. Ask whether any national element goes beyond the common framework, and whether the Central Bank expects the test to be reported in a particular format. Use the ECB's September 2024 paper on DORA and TIBER-EU to explain the common core, which the ECB describes as identical for DORA TLPT and TIBER-EU, so you know which questions are about national detail rather than the core.
Finally, ask for the current supplementary TIBER-IE material and confirm its version date. The Central Bank supplies this material to the institution at the start of each assessment, and it was revised after DORA applied from 17 January 2025, so an older copy held by your team may no longer match the programme. Ask who the single contact for the test is, how the Central Bank wants procurement of threat intelligence and red team providers evidenced, and whether the ECB guidance on service provider procurement, the control team and purple teaming applies unchanged. Record the answers in the initiation documents so the scope signed with your provider reflects them.
How DeployOpen works on this
DeployOpen prepares the systems, documentation and evidence that a firm needs for a TIBER-IE test under the Central Bank of Ireland's programme. The Central Bank, its test team, the threat intelligence provider and the red team testers keep their own roles, and DeployOpen does not issue any test result or attestation.
How we scope
- Our written scope lists the systems, environments and documentation we will prepare for the firm's TIBER-IE test.
- We confirm with the firm which functions and flags fall within our preparation work and which belong to the control team or providers.
- Engagements are fixed-scope, so deliverables and timelines are agreed in writing before any work begins.
How we build
- We prepare self-hosted open-source platforms and their logging inside the firm's own infrastructure, so evidence can be produced from the firm's environment.
- We document configurations, access paths and monitoring coverage that the control team and blue team need during the test.
- We support the firm's internal preparation of control team records and the purple teaming material described in the ECB guidance.
How we hand over
- We deliver the system documentation, configuration records and evidence packs agreed in the written scope.
- We walk the firm's team through handover material so they can run and explain the environment without us.
- We do not issue reports, attestations or certificates; the Central Bank and independent parties own those outputs.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the engagement closes.
- We can help the firm update its documentation and evidence when the TIBER-IE or DORA TLPT requirements change.
- Ask us to confirm in writing which support tasks are covered by the retainer before signing.
